MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32031ca4487b08af41a597da7d22c05a3d4f676c33119c057f3f4a1431217887. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	32031ca4487b08af41a597da7d22c05a3d4f676c33119c057f3f4a1431217887
SHA3-384 hash:	d756bd91690dc529d94d5c8ad7957f84f0992498c8643bf065458e32af95d50506d6cfddb532678895fd271e1669877f
SHA1 hash:	81f575d685775cd1c27ad0c43b55a6d398ba0023
MD5 hash:	9536985f58e43f8eb4629534c6787951
humanhash:	butter-juliet-seven-washington
File name:	prc.dll
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	3'475'968 bytes
First seen:	2020-05-15 06:56:19 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	3c40312a17d7028c500c6468084c6a58 (7 x Gozi, 2 x DanaBot)
ssdeep	49152:vBB+DbwBoIK6d8kMvEOzzW2efqjnNXmUp+wtyQoI/M8VglMCXL1xFN/ZtakkoOmE:vQDGa/maNWa+KwhxzRkczXTgdt
Threatray	21 similar samples on MalwareBazaar
TLSH	89F5DF107712D038F56B0A7AEC3ED4FA95287E459B3818D730C56E8F2633AD65872B1B
Reporter	abuse_ch
Tags:	DanaBot dll geo POL

abuse_ch

Malspam distributing DanaBot:

HELO: mout-xforward.gmx.com
Sending IP: 82.165.159.130
From: PLAY 24 <Gretta.Hyman14192@mail.com>
Subject: efaktura - PLAY24 2889961
Attachment: faktura_30.xlsm

DanaBot payload URL:
http://post-990094.at/3/prc.dll

DanaBot C2s:
172.81.129.196:443
192.236.179.73:443
192.99.219.207:443
23.82.140.201:443
45.147.228.92:443
51.255.134.130:443
54.38.22.65:443

Intelligence

File Origin

# of uploads :

# of downloads :

815

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/3779/

Detection(s):

SecuriteInfo.com.Win32.Kryptik.HDJT.13455.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Danabot

Status:

Malicious

First seen:

2020-05-15 07:36:12 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

21 of 30 (70.00%)

Threat level:

5/5

Verdict:

malicious

Label(s):

gozi

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-53y6vc4zb2/

Behaviour

Suspicious use of WriteProcessMemory

Blacklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_danabot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator